Skip to content
Leak-site post naming Buford-Thompson Company, LTD, captured by ThreatCluster

Buford-Thompson Company, LTD

aurora

Ransomware leak-site victim intelligence · EN

Data size
1.707 TB
Views
541
Posted
Jan 1, 2024
Countdown
5 days : 23 hours : 34 min : 12 sec
Country
US
Industry
construction

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Aurora claims Buford-Thompson Company, LTD, a Texas construction contractor, exfiltrated 1.707 TB of data, including HR records, PII (SSNs and addresses), attorney-client privileged files, banking/financial data, blueprints/project data, donor records with PII, and personal records. The leak page identifies the victim as Buford-Thompson Company, LTD (domain btcbuilds.com) and shows a data-publishing countdown of 5 days, 23 hours, 34 minutes, 12 seconds; the publication status is listed. The page also lists the victim’s HQ as 1450 N. Jim Wright Freeway, White Settlement, Texas 76108.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
30
Domains
btcbuilds.com

What was taken

Buford-Thompson Company, LTD, a Texas construction general contractor with 30+ years of history building schools for K-12 districts across the state.

Data categories
HR recordsPII including SSNs and addressesattorney-client privileged filesbanking/financial datablueprints/project datadonor records with PIIpersonal records
Leak site tags
TexasK-12school constructionPIIPayrollDonor records

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Data Publishing
5 days : 23 hours : 34 min : 12 sec

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture